An NSM analyst is reviewing Zeek logs and sees conn.log entries wit…

Question

An NSM analyst is reviewing Zeek logs and sees conn.log entries with connstate of 'S0'. What does this connection state indicate?

Accepted Answer

A connection attempt (SYN sent) with no response — the connection was never established, typical of port scanning or unreachable hosts — Here's the deal — 'S0' means Zeek saw a SYN but never got a SYN-ACK back. That's a connection attempt that never established, which is what you'd expect from port scanning or an unreachable host.

Answer

A connection that completed the full three-way handshake and successfully exchanged data in both directions before being closed normally by the originator

Answer

A connection that was reset by the responder

Answer

A connection where the originator terminated gracefully with a FIN

An NSM analyst is reviewing Zeek logs and sees `conn.log` entries with `conn_state` of 'S0'. What does this connection state indicate?

Short Explanation

Full Explanation

An NSM analyst is reviewing Zeek logs and sees conn.log entries with conn_state of 'S0'. What does this connection state indicate?

Short Explanation

Full Explanation

An NSM analyst is reviewing Zeek logs and sees `conn.log` entries with `conn_state` of 'S0'. What does this connection state indicate?